Two application VPCs are peered. The security team must stop one VPC from reaching the database subnet in the other. The campus site-to-site VPN must stay unchanged. Which policy is this?
Select an answer to reveal the explanation.
Short Explanation
The two buildings already share a hallway, and you need a lock on that hallway. You put an east-west rule on the peering path between the VPCs. Backhauling their internet egress does not stop one VPC from walking into the other's database subnet.
Full Explanation
Traffic between two peered VPCs is east-west inside the cloud. A security group, network ACL, or firewall policy on that peering path can deny the database subnet without touching the campus VPN. Backhaul sends internet-bound traffic from the VPCs through the campus. It does not filter VPC-to-VPC flows that never leave AWS. An inbound publish rule accepts sessions that start on the public internet. The database flow starts in the other VPC. A longer IKE lifetime retimes the campus tunnel. The requirement says that VPN stays unchanged, and the lifetime would not segment the peering path anyway. Exam caveat: VPC peering is not transitive, and a firewall appliance in a third VPC only sees this flow if routing sends it there. The rule has to sit on the path the packets actually take. Operational check: a test instance in the first VPC should fail to reach the database port, and the campus VPN tunnel status should stay up.